Field
This field is generally related to traffic monitoring.
Related Art
Network services may, for example, provide connectivity from a customer network to another computer network, such as the Internet. A client connects to a server using a connectivity service provided by a connectivity service provider. Multiple routers in a connectivity service provider environment may concurrently carry traffic with identical or similar content to one or more clients leading to inefficient usage of network resources.
A data stream transmitted from a content service provider (e.g., media content service provider, voice-over-IP (VOIP) service provider, etc.) to a client (e.g., an end user) is typically identified by a series of data packets sharing a source and destination address, and protocol information. For example, packets in a data stream may have a common source IP address, source port address, destination IP address, destination port address, and protocol information. In a specific example, a data stream may correspond to a media streaming session for a client streaming a movie from a media content provider.
In a connectivity service provider environment, two or more clients may be simultaneously receiving the same content from a common content provider. For example, two end users may be streaming the same movie concurrently. Alternatively, one end user may be receiving a very heavy (requiring high bandwidth) data stream that is sent to the end user through two or more paths at the same time. To this end, two or more routers in the connectivity service provider environment may be relaying similar or identical content to two or more clients.
A connectivity service provider may be interested in knowing that two or more of its clients are concurrently receiving the same or identical data streams. This information may be used by the service provider for a variety of reasons. For example, the connectivity service provider may leverage this information to provide a better route for this data stream through its routers, improving the efficiency of using network resources. In other examples, the connectivity service provider may use this information to perform multicasting, or data compression.
Different streams may use different protocols. It is possible for the connectivity service provider to inspect the traffic going through its routers, and identify how much traffic per unit time is being relayed for each protocol. Different protocols may include media streaming, voice over IP (VoIP), etc. Additionally, to identify similar streams, a connectivity service provider may look into packets being relayed through its routers.
However, it is often not enough to just look at the information in the header of packets of two data streams to identify whether these two streams are carrying the same content. For example, if a data stream is being simultaneously sent to two different end users, the destination IP address (and possibly the destination port address) of the packets addressed to these two end users are different. Therefore, a mechanism is required to look into the payload of the packets of two data streams to determine that they carry the same content.
However, parsing the payload of packets being relayed through the routers of a connectivity service provider is typically very computation-intensive. Additionally, parsing packets intended for a client may violate the client's privacy. Therefore, a different method is desired for identifying similar streams by looking at the payload of the packets being related through the routers of a connectivity service provider.